CVE-2026-110635
webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js…
- Risk score
- 81/100
- CVSS
- 9.8 v3.1
- Exploit chance (30 days)
- 2.5%
- Published
- 14 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled. Attackers controlling file names or option strings passed to cwebp, dwebp, gwebp, or webpmux functions can inject shell metacharacters to execute OS comm…
- Affected
- See advisory
- Fix
- Upgrade the product to 3.0.0 or later.
- Exploitation
- No known exploitation
Why it is Red
- CVSS 9.8 critical
- Remotely exploitable without logging in
References
- https://github.com/scionoftech/webp-converter
- https://github.com/scionoftech/webp-converter/blob/3729b65f1e904ab56b947ac3772020ce37a756c8/src/webpconverter.js#L41-L52
- https://github.com/scionoftech/webp-converter/blob/e09d963d772cae9ff6af63c268ca838ab334f861/CHANGELOG.md
- https://github.com/scionoftech/webp-converter/commit/f1b6724bc2e89f67ab05d51a854b4b1c5a99928a
- https://github.com/scionoftech/webp-converter/pull/53
- https://github.com/scionoftech/webp-converter/pull/53#issuecomment-5091652605
- https://www.vulncheck.com/advisories/webp-converter-before-3.0.0-os-command-injection-via-file-names-and-options
Original description
webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled. Attackers controlling file names or option strings passed to cwebp, dwebp, gwebp, or webpmux functions can inject shell metacharacters to execute OS commands as the Node.js process.
Last activity 14 Oct 2026. Patch Forecast updates every hour.